Removing the CryptoWall 3.0 Virus: How to Decrypt CryptoWall 3.0 Encrypted Files

CryptoWall 3.0 ransomware has taken the world by storm. The ransomware is capable of encrypting all your personal files if your device is infected. It uses the AES-CBC 256-bit encryption algorithm, which is the RSA 2048 key, to encrypt data on the victim’s computer. The malware then threatens the victim about destroying the data if their ransom of $500 is not paid within the timeframe requested (96 hours). If the ransom is not paid within 7 days then the amount grows up to $1000. Thus, the victim needs to be extra careful with the given timeframe and make the payment in Bitcoins.

But, worry not. If you ever get infected with this cryptographic ransomware, this article will teach you to remove it without breaking a sweat. Keep reading.

Modus Operandi

CryptoWall 3.0 can easily target all versions of Windows. The ransomware can spread through different means such as malicious websites, spam emails and even infected advertisements known as malvertising. They may send an email to you stating delivery of a package has failed or that a package is being shipped. Upon downloading the attachment, you’re voluntarily infecting your system. It will create an executable in your %AppData% or %LocalAppData% folder. Once the executable is launched, it will scan your drives for files to be encrypted. Some of the files that it seeks to encrypt are .pdf, .doc, .docx, .xlx, .gif, .jpg, .jpeg etc.

Further, it creates a HELP_DECRYPT.txt file and changes your wallpaper to HELP_DECRYPT.html. Both these changes tell you the method to decrypt your files using a URL. The URL will direct to an anonymous TOR website which will tell you the ransom amount and the mode of payment.

Remove CryptoWall 3.0

Following are the methods to remove the CryptoWall 3.0.

  • Using automatic cleaner

A good virus remover can help you in getting rid of any malicious program on your system. However, you may not be assured that you can recover all your encrypted files, but you can definitely eliminate/reduce the chances of getting infected again. The idea is simple, just download the software, install it and scan the entire system. The software will then scan the system and report the intrusions on your system. Choose Fix Threats, and once the tool has found CryptoWall 3.0 and complete the extermination procedure.

  • Using System Restore

You can simply perform the System Restore to remove the ransomware from your system.

  • Open the Windows Advanced Options from the boot menu.
  • Then, select Safe Mode with Command Prompt from the list.
  • In the Command Prompt and type cd restore and press Enter.
  • Then, type rstrui.exe and press Enter
  • Now, choose Next.
  • Choose, a Restore Point and perform the system restore.

Decrypting the files

You can try the following methods to decrypt the files:

  • Automatic file recovery software

CryptoWall 3.0 deletes the original file and creates a copy which is then encrypted. Thus, it is the copy which is encrypted and not the original file. Thus, it becomes easier for tools like Data Recovery Pro to restore the deleted files. Thus, it can even recover the files deleted in a secure way.

  • Shadow Volume Copies

You can go to the Properties dialog and choose the Previous Versions. Then, you can recover the backed up versions to recover the files. Just right click on the file and go to Properties. And then, select Copy or Recover option and easily recover the files.


The manual backup techniques may not work as expected and some parts may still remain. Thus, it is advised that you back up the files and keep scanning the device to avoid infection. Making sure that the system is not infected is the only way to protect yourself fully from the ransomware. Someone has wisely said that “Prevention is better than cure.”


Introducing iSheriff Cloud Security

CryptoWall 3.0, ransomware, cybersecurity

Subscribe to Email Updates

About iSheriff

iSheriff is the leading provider of content and endpoint security from the cloud. We keep organizations and individuals safe from cybercrime, malware and digital threats. Thousands of businesses across a wide array of industries have deployed our solutions, including some of the most sophisticated buyers of security technology worldwide.